Modernizing Your Approach to Third-Party Risk Management with HITRUST

Your systems may be secure, and your controls tested and verified by trusted auditors. But data doesn’t stop at the edge of your environment. It flows into the vendors, platforms, and processors you rely on, and when you adopt those tools, you adopt the risks in their environments too. 

Third-party risk management (TPRM) isn’t a nice-to-have. It’s a standard part of any high-quality compliance program, and for HITRUST-certified organizations, it’s a mandate. 

HITRUST’s new TPRM program gives organizations that work with PHI or PII a simpler way to run TPRM. The result is stronger security across your vendor ecosystem and a faster way to verify vendor certification. 

Risks of mismanaged TPRM 

According to the 2025 Verizon Data Breach Investigations Report, 48% of breaches that year involved a third party. That shows how much risk hides behind a shallow view of your vendors. 

As your vendor ecosystem grows in size and complexity, validating each vendor’s compliance gets harder. Outdated TPRM approaches often lead to: 

• Results that can’t be compared across vendors 

• Inconsistent findings 

• Delayed decision-making 

• Weak evidence and defensibility 

• Limited visibility into vendor risk 

The new HITRUST TPRM program 

The program is designed to simplify the process for relying parties, the organizations that require HITRUST from their vendors. Assessed entities, the vendors responsible for proving their security, also benefit from a streamlined process and a clearer way to keep and grow their business. 

Benefits of the new HITRUST TPRM program 

HITRUST’s TPRM program lets your team rely on HITRUST certification results instead of lengthy questionnaires, freeing up time to strengthen your compliance posture. HITRUST reports that relying parties see: 

• 8 to 20 hours of manual effort eliminated per vendor assessment 

• 3x to 5x greater vendor assessment throughput 

• Up to 50% reduction in TPRM operational costs 

• 50% to 60% efficiency gains through automation 

Certified vendors also strengthen the relying party’s compliance posture: in 2025, 99.62% of HITRUST-certified environments were breach-free. 

How HITRUST TPRM differs from questionnaires 

HITRUST’s TPRM program replaces fragmented assessments with a single, scalable solution across your vendor ecosystem. It provides: 

• A common assurance language 

• Threat intelligence-driven controls 

• Independent assessment 

• Centralized QA, scoring, and certification 

• Proven, measurable risk reduction 

How it works 

The program replaces manual questionnaires with standardized, validated HITRUST assurances. That reduces cost, simplifies reviews, and strengthens the overall security posture of certified organizations. The service is free to the relying party. 

The assurance ecosystem 

The program involves four participants: 

• Relying party: The organization that requires HITRUST from its vendors. It relies on certified results instead of questionnaires. 

• Assessed entity: The vendor asked to become HITRUST certified. It uses certification to win and keep the relying party’s business. 

• External assessor: A-LIGN, an independent, HITRUST-authorized assessor. We test controls and submit the assessment to HITRUST. 

• HITRUST: Owns the Common Security Framework (CSF), quality-reviews 100% of submissions, certifies, and shares results with relying parties. 

Steps to completion 

Six steps take you from commitment to reliance. 

1. Commit: Secure executive sponsorship and add a security addendum that requires HITRUST. 
2. Map: HITRUST maps your vendor list and questionnaires to assessment tiers. 
3. Model: HITRUST models third-party loss expectancy and compliance costs. 
4. Onboard: Vendor onboarding launches, and vendors are directed to A-LIGN. 
5. Certify: A-LIGN assesses each vendor, and HITRUST reviews 100% of submissions and certifies. 
6. Rely: The relying party accepts current certifications as a fast pass. 

Why A-LIGN 

A-LIGN is a HITRUST-authorized External Assessor Organization that has completed more than 1,400 HITRUST assessments. Our assessor expertise and purpose-built audit platform make HITRUST certification achievable. Talk to our team to start your HITRUST journey.